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DETAILED ACTION 

Claims 1-45 are pending. 

Claim Rejections - 35 USC §112 

The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

Claims 25, 26,27 and 28 are rejected under 35 U.S.C. 112, second 
paragraph, as being indefinite for failing to particularly point out and distinctly 
claim the subject matter which applicant regards as the invention. 

Claim 25 recites the limitation "the history cache for each user identifier" in 
lines 3-4. There is insufficient antecedent basis for this limitation in the claim. 
Examiner suggests replacing with "the history cache for each identifier" for proper 
antecedent basis. For purposes of prior rejections claim is interpreted as "each 
identifier". 

Claims 26 and 28 recite the limitation "the aggregation table entry" in lines 
2 and 3, respectively. There is insufficient antecedent basis for this limitation in 
the claim. Examiner suggests replacing with "the record event set" for proper 
antecedent basis. For purposes of prior rejections claim is interpreted as "the 
record event set". 

Claim 27 recites the limitation "the aggregation table" in lines 2. There is 
insufficient antecedent basis for this limitation in the claim. Examiner suggests 
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replacing with "the record event set" for proper antecedent basis. For purposes of 
prior rejections claim is interpreted as "the record event set". 

Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 
U.S.C. 102 that form the basis for the rejections under this section made in this 
Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1 ) an application for patent, published under section 
122(b), by another filed in the United States before the invention by the applicant for patent or 
(2) a patent granted on an application for patent by another filed in the United States before 
the invention by the applicant for patent, except that an international application filed under 
the treaty defined in section 351(a) shall have the effects for purposes of this subsection of an 
application filed in the United States only if the international application designated the United 
States and was published under Article 21(2) of such treaty in the English language. 

Claims 1-2, 37-38, and 45 are rejected under 35 U.S.C. 102(e) as being 
anticipated by Porras et al. (US Patent 6,321,338), hereinafter referred to as 
Porras. 

In reference to claim 1, Porras discloses a method for network 
surveillance that includes real-time measuring and monitoring of network traffic, 
in order to subsequently generate network statistical profiles (abstract). Porras 
explicitly discloses: 

• A method for analyzing a stream of network data, (column 1 , lines 44-54; 
column 4, line 60 to column 5, line 3;column 5, line 30-52; and column 3, lines 
42-54), comprising: 

• Generating a statistical model (i.e. statistical profile) from a set of record 
events, (column 4, line 60 to column 5, line 3 and column 5, line 30-52); 
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• Receiving a most recent record event, (column 2, lines 11-18 and column 
6, lines 37-52); and 

• Updating the statistical model using the most recent event by adding the 
most recent record to the statistical model, (column 2, lines 11-18 and 
column 6, lines 37-52). 

In reference to claim 37, Porras explicitly discloses a system for employing 
the aforementioned method, (column 2, lines 2-10 and Figure 2). Porras 
explicitly shows: 

• A network usage analysis system for analyzing a stream of network data, 
(column 2, lines 2-10;column 1 , lines 44-54; column 4, line 60 to column 5, 
line 3;column 5, line 30-52; and column 3, lines 42-54) comprising: 

• A data analysis server (i.e. monitor) which generates a statistical model 
(i.e. statistical profile) from a set of record events, and upon receiving a 
most recent record event, the data analysis system server updates the 
statistical model using the most recent record event by adding the most 
recent record event to the statistical model, (column 3, lines 32-54; column 
4, line 48 to column 5, line 3; column 2, lines 11-18 and column 6, lines 
37-52). 

All subsequent system claims will be discussed with the appropriately 
associated method claims. 
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In reference to claim 45, Porras explicitly discloses a computer program 
product on a computer readable medium for employing the aforementioned 
method, (column 2, lines 25-35). Porras explicitly shows: 
• A computer readable medium having computer executable instructions for 
performing a method for analyzing a stream of network data, (column 2, lines 
25-35; column 1, lines 44-54; column 4, line 60 to column 5, line 3;column 5, 
line 30-52; and column 3, lines 42-54) the method comprising: 

• Generating a statistical model (i.e. statistical profile) from a set of record 
events, (column 4, line 60 to column 5, line 3 and column 5, line 30-52); 

• Receiving a most recent record event, (column 2, lines 11-18 and column 
6, lines 37-52); and 

• Updating the statistical model using the most recent event by adding the 
most recent record to the statistical model, (column 2, lines 11-18 and 
column 6, lines 37-52). 

In reference to claims 2 and 38, Porras explicitly shows the limitations, 
(column 6, lines 47-50). 



Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for 
all obviousness rejections set forth in this Office action: 
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(a) A patent may not be obtained though the invention is not identically disclosed or described 
as set forth in section 102 of this title, if the differences between the subject matter sought to 
be patented and the prior art are such that the subject matter as a whole would have been 
obvious at the time the invention was made to a person having ordinary skill in the art to which 
said subject matter pertains. Patentability shall not be negatived by the manner in which the 
invention was made. 

Claim 13 is rejected under 35 U.S.C. 103(a) as being 
unpatentable over Porras et al. (US Patent 6,321,338) and further in view of 
Sarkissian et al (US Patent 6,771,646), hereinafter referred to as Porras and 
Sarkissian, respectively. 

In reference to claim 13, Porras discloses a method for network 
surveillance that includes real-time measuring and monitoring of network traffic, 
in order to subsequently generate network statistical profiles (abstract). Porras 
explicitly discloses: 

• A method for analyzing a stream of data over a rolling time (i.e. short-term or 
long-term) interval comprising, (column 1, lines 44-54; column 4, line 60 to 
column 5, line 3;column 5, line 30-52; and column 3, lines 42-54): 

* 

• Defining a statistical model for analyzing the stream of data over the 
rolling time interval, (column 5, lines 30-52 and column 6, lines 38-52); 

• Defining the rolling time interval to include a plurality of update intervals, 
(column 2, lines 11-19 and column 5, lines 30-35; column 6, lines 38-52); 

• Receiving a record event from the stream of data for each update time 
interval, (column 2, lines 11-19 and column 5, lines 30-35; column 6, lines 38- 
52); 
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• Generating the statistical model over the rolling time interval using the 
statistical model and each record event, (column 2, lines 11-19 and column 5, 
lines 30-35; column 6, lines 38-52); and 

• Updating the statistical model using the statistical model and a most recent 
record event for a most recent update time interval, (column 2, lines 11-18 
and column 6, lines 37-52). 

Although Porras disclose substantial features of the claimed invention, the 
reference fails to explicitly disclose: storing the record event for each update in a 
history cache; and generating a statistical model each record event stored in the 
history cache. Nonetheless, this would have been an obvious modification to the 
aforementioned method to one of ordinary skill in the art at the time of the 
invention, as further evidenced by Sarkissian. 

In an analogous art, Sarkissian discloses a method that involves 
employing a cache subsystem for storing flow-based statistical measures, and 
subsequent supports real-time network monitoring (column 2, lines 30-32; 
column 2, lines 50-67; column 3, lines 1-15; column 4, line 54 to column 5, line 
24; and column 19, line 55 to column 20, line 2). One of ordinary skill in the art 
would have been so motivated to implement this into feature into the 
aforementioned methodology as disclosed by Porras, so as to reduce latency 
time associated with memory accesses thereby improving process efficiency, 
(Sarkissian column 2, lines 57-67). 
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Claims 23 and 26 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Porras et al. (US Patent 6,321,338), and in view of 
Sarkissian et al (US Patent 6,771,646), and further in view of Kawasaki (US 
Patent 6,539,375) and Fishman et al. (US Patent Application Publication 
2001/0037321), hereinafter referred to as Porras Sarkissian, Kawasaki, and 
Fishman respectively. 

In reference to claim 23, Porras discloses a method for network 
surveillance that includes real-time measuring and monitoring of network traffic, 
in order to subsequently generate network statistical profiles (abstract). Porras 
explicitly discloses: 

• A method for analyzing a stream of data over a rolling time (i.e. short-term or 
long-term) interval comprising, (column 1, lines 44-54; column 4, line 60 to 
column 5, line 3;column 5, line 30-52; and column 3, lines 42-54): 

• Defining a statistical model for analyzing the stream of data over the 
rolling time interval, (column 5, lines 30-52 and column 6, lines 38-52); 

• Defining the rolling time interval to include a plurality of update intervals, 
(column 2, lines 1 1^19 and column 5, lines 30-35; column 6, lines 38-52); 

• Receiving a record event from the stream of data for each update time 
interval, (column 2, lines 11-19 and column 5, lines 30-35; column 6, lines 38- 
52); 

• Generating the statistical model over the rolling time interval using the 
statistical model and each record event, (column 2, lines 11-19 and column 5, 
lines 30-35; column 6, lines 38-52); and 
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• Updating the statistical model using the statistical model and a most recent 
record event for a most recent update time interval, (column 2, lines 11-18 
and column 6, lines 37-52). 
Although Porras disclose substantial features of the claimed invention, the 
reference fails to explicitly disclose: storing the record event for each update in a 
history cache; and generating a statistical model each record event stored in the 
history cache. Nonetheless, this would have been an obvious modification to the 
aforementioned method to one of ordinary skill in the art at the time of the 
invention, as further evidenced by Sarkissian. 

In an analogous art, Sarkissian discloses a method that involves 
employing a cache subsystem for storing flow-based statistical measures, and 
subsequent supports real-time network monitoring (column 2, lines 30-32; 
column 2, lines 50-67; column 3, lines 1-15; column 4, line 54 to column 5, line 
24; and column 19, line 55 to column 20, line 2). One of ordinary skill in the art 
would have been so motivated to implement this into feature into the 
aforementioned methodology as disclosed by Porras, so as to reduce latency 
time associated with memory accesses thereby improving process efficiency, 
(Sarkissian column 2, lines 57-67). In addition, the references fail to disclose: 
each record event set including one or more record events, wherein each record 
event is associated with a user identifier. Nonetheless, this would have been an 
obvious modification to the aforementioned method to one of ordinary skill in the 
art at the time of the invention, as further evidenced by Kawasaki. 
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In another analogous art, Kawasaki discloses associating record events to 
a use identification (i.e. user profile), used in a method for tracking network (i.e. 
Internet) usage of users, (column 2, lines 47-54; column4, lines 42-61). This 
modification to the aforementioned method would have been obvious, because 
one of ordinary skill in the art would have been so motivated to identifier specific 
users in order to further correlate network activity records thereby improving 
detection of abnormal network activity, (Porras column 2, lines 54-64). In 
addition, the references fail to disclose updating only a portion of the statistical 
model associated with the most recent record event. Nonetheless, this would 
have been an obvious modification to the aforementioned method to one of 
ordinary skill in the art at the time of the invention, as further evidenced by 
Fishman. 

In another analogous art, Fishman discloses a method for generating 
statistical models, in which the aforementioned model is updated by processing 
only the newly available records, (paragraph [0008], lines 1-18; paragraph 
[0010], lines 1-5; and abstract). One of ordinary skill in the art would have been 
so motivated to implement this modification into the aforementioned method in 
order to quickly update the model, thereby improving processing speed (Fishman 
paragraph [0037], lines 1-3). 
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In reference to claim 26, Porras Sarkissian, Kawasaki, and Fishman 
explicitly show the limitations, (Fishman paragraph [0008], lines 1-18; paragraph 
[0010], lines 1-5; and abstract). 

Claims 29,31-35 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Porras et al. (US Patent 6,321,338), and in view of 
Sarkissian et al. (US Patent 6,771,646), and further in view of Fishman et al. 
(US Patent Application Publication 2001/0037321) and Costa (US Patent 
6,138,121) hereinafter referred to as Porras Sarkissian, Fishman, and Costa 
respectively. 

In reference to claim 29, Porras discloses a method for network 
surveillance that includes real-time measuring and monitoring of network traffic, 
in order to subsequently generate network statistical profiles (abstract). Porras 
explicitly discloses: 

• A method for analyzing a stream of data over a rolling time (i.e. short-term or 
long-term) interval comprising, (column 1 , lines 44-54; column 4, line 60 to 
column 5, line 3;column 5, line 30-52; and column 3, lines 42-54): 

• Defining a statistical model for analyzing the stream of data over the 
rolling time interval, (column 5, lines 30-52 and column 6, lines 38-52); 

• Defining the rolling time interval to include a plurality of update intervals, 
(column 2, lines 11-19 and column 5, lines 30-35; column 6, lines 38-52); 



Application/Control Number: 09/919,527 Page 
Art Unit: 2153 

• Receiving a record event from the stream of data for each update time 
interval, (column 2, lines 11-19 and column 5, lines 30-35; column 6, lines 
38-52); 

• Generating the statistical model over the rolling time interval using the 
statistical model and each record event, (column 2, lines 11-19 and 
column 5, lines 30-35; column 6, lines 38-52); and 

• Updating the statistical model using the statistical model and a most 
recent record event for a most recent update time interval, (column 2, lines 
1 1 -1 8 and column 6, lines 37-52). 

Although Porras disclose substantial features of the claimed invention, the 
reference fails to explicitly disclose: storing the record event for each update in a 
history cache; and generating a statistical model each record event stored in the 
history cache. Nonetheless, this would have been an obvious modification to the 
aforementioned method to one of ordinary skill in the art at the time of the 
invention, as further evidenced by Sarkissian. 

In an analogous art, Sarkissian discloses a method that involves 
employing a cache subsystem for storing flow-based statistical measures, and 
subsequent supports real-time network monitoring (column 2, lines 30-32; 
column 2, lines 50-67; column 3, lines 1-15; column 4, line 54 to column 5, line 
24; and column 1 9, line 55 to column 20, line 2). One of ordinary skill in the art 
would have been so motivated to implement this into feature into the 
aforementioned methodology as disclosed by Porras, so as to reduce latency 
time associated with memory accesses thereby improving process efficiency, 
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(Sarkissian column 2, lines 57-67). In addition, the references fail to disclose 
generating an aggregation table. Nonetheless, this would have been an obvious 
modification to the aforementioned method to one of ordinary skill in the art at the 
time of the invention, as further evidenced by Costa. 

In another analogous art, Costa discloses a method for network management in 
which an aggregation table is employed for tracking system data and generating 
statistical reports, (column 2, lines 21-31; column 8, lines 1-41; column 8, lines 
53 to column 9, line 5). One of ordinary skill in the art would have been so 
motivated to implement this modification into the aforementioned method, so as 
to increase the ease of performing various actions (e.g. access, aggregate, 
extract, etc.) On relevant statistical data thereby increasing process efficiency, 
(Costa column 2, lines 15-18). In addition, the references fail to disclose updating 
only a portion of the statistical model associated with the most recent record 
event. Nonetheless, this would have been an obvious modification to the 
aforementioned method to one of ordinary skill in the art at the time of the 
invention, as further evidenced by Fishman. 

In another analogous art, Fishman discloses a method for generating 
statistical models, in which the aforementioned model is updated by processing 
only the newly available records, (paragraph [0008], lines 1-18; paragraph 
[0010], lines 1-5; and abstract). One of ordinary skill in the art would have been 
so motivated to implement this modification into the aforementioned method in 
order to quickly update the model, thereby improving processing speed (Fishman 
paragraph [0037], lines 1-3). 
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In reference to claims 31-35 Porras Sarkissian, Fishman, and Costa 
explicitly show the limitations, (Porras column 2, lines 11-19 and column 5, lines 
30-35; column 6, lines 38-52; and Sarkissian column 2, lines 30-32; column 2, 
lines 50-67; column 3, lines 1-15; column 4, line 54 to column 5, line 24; and 
column 19, line 55 to column 20, line 2). 

Claims 3 and 39 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Porras as applied to claims above, and further in view of 
Steinbiss et al. (US Patent 6,823,307), hereinafter referred to as Steinbiss. 

In reference to claim 3 and 39, although Porras discloses substantial 
features of the aforementioned method, the reference fails to explicitly disclose 
the method further comprising the step of: storing the set of records in a history 
cache, and wherein if the history cache is full, updating the statistical model 
includes removing a least recent event from the statistical model. Nonetheless, 
this would have been an obvious modification to the aforementioned method, as 
disclosed by Porras, to one of ordinary skill in the art at the time of the invention, 
as further evidenced by Steinbiss. 

In an analogous art, Steinbiss discloses a method for employing 
stochastic models that involves storing recently recognized elements in a cache, 
(abstract; column 2, lines 25-38; and column 5, lines 15-30). Steinbiss further 
discloses once the cache is full, removing the least recently stored element, 
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(column 5, line 60 to column 6, line 7). This modification would have been 
obvious, because one of ordinary skill in the art would have been so motivated to 
implement this feature so as to maximize available memory space, thereby 
reducing cost associated with larger capacity cache memories, (Steinbiss column 
5, line 66 to column 6, line 3). 

Claims 4 and 40 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Porras and Steinbiss as applied to claims above, and 
further in view of Sarkissian et al. (US Patent 6,771,646), hereinafter 
referred to as Sarkissian. 

In reference to claims 4 and 40, Porras and Sarkissian disclose 
substantial features of the claimed invention, specifically the statistical model (i.e. 
statistical profile) including an aggregation of each event record set, (Porras 
column 6, lines 38-52). However the references fail to explicitly disclose: 
generating a statistical model each record event stored in the history cache. 
Nonetheless, this would have been an obvious modification to the 
aforementioned method to one of ordinary skill in the art at the time of the 
invention, as further evidenced by Sarkissian. 

In an analogous art, Sarkissian discloses a method that involves 
employing a cache subsystem for storing flow-based statistical measures, and 
subsequent supports real-time network monitoring (column 2, lines 30-32; 
column 2, lines 50-67; column 3, lines 1-15; column 4, line 54 to column 5, line 
24; and column 19, line 55 to column 20, line 2). One of ordinary skill in the art 
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would have been so motivated to implement this into feature into the 
aforementioned methodology as disclosed by Porras, so as to reduce latency 
time associated with memory accesses thereby improving process efficiency, 
(Sarkissian column 2, lines 57-67). 

Claims 5-6, 12, and 41-42 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Porras, Steinbiss, and Sarkissian as applied to claims 
above, and further in view of Costa et al. (US Patent 6,138,121), hereinafter 
referred to as Costa. 

In reference to claims 5 and 41, Porras, Steinbiss, and Sarkissian show 
substantial features of the claimed invention, specifically the method wherein an 
identifier (i.e. category) is associated with each record event, (Porras column 5, 
lines 4-30 and column 5, lines 49-64). However, the references fail to show the 
method wherein generating a statistical model from the set pf record events 
includes generating an aggregation table for tracking and aggregation of record 
events associated with an identifier. Nonetheless, this modification to the 
aforementioned method, as disclosed by the references, would have been 
obvious to one of ordinary skill in the art at the invention, as further evidenced by 
Costa. 

In an analogous art, Costa discloses a method for network management in 
which an aggregation table is employed for tracking system data and generating 
statistical reports, (column 2, lines 21-31; column 8, lines 1-41; column 8, lines 
53 to column 9, line 5). One of ordinary skill in the art would have been so 
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motivated to implement this modification into the aforementioned method, so as 
to increase the ease of performing various actions (e.g. access, aggregate, 
extract, etc.) on relevant statistical data thereby increasing process efficiency, 
(Costa column 2, lines 15-18). 

In reference to claims 6 and 42, Porras, Steinbiss, Sarkissian, and Costa 
explicitly show the limitations, (Costa column 2, lines 21-31; column 8, lines 1-41; 
column 8, lines 53 to column 9, line 5). 

In reference to claim 12 Porras, Steinbiss, Sarkissian, and Costa explicitly 
show the limitations, (Sarkissian column 19, line 55 to column 20, line 2). 

Claims 7, 11, 14-22, and 24-25 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over Porras, Steinbiss, Sarkissian, and Costa as 
applied to claims above, and further in view of Aboulnaga et al. (US Patent 
6,460,045), hereinafter referred to as Aboulnaga. 

In reference to claims 7 and 11, although Porras, Steinbiss, Sarkissian, 
and Costa show substantial features to the claimed invention, the references fail 
to show explicitly the method generating a histogram statistical model 
representative of the network data. Nonetheless, histogram statistical models 
were well known in the art at the time of the invention, as further evidenced by 
Aboulnaga. Therefore, this limitation would have been an obvious modification to 
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the aforementioned method, as disclosed by the references, for one of ordinary 
skill in the art. 

In an analogous art, Aboulnaga discloses a method of building histogram 
statistical models, (column 5, line 37 to column 6, line 3). This modification would 
have been obvious to one of ordinary skill in the art, so as to increase the 
accuracy of the statistical model estimations and thereby increasing process 
effectiveness, (Aboulnaga column 1 , lines 54-55). 

In reference to claims 14 and 24, Porras, Steinbiss, Sarkissian, Costs and 
Aboulnaga explicitly show the limitations, (Steinbiss column 5, line 60 to column 
6, line 7). 

In reference to claims 15-22, Porras, Steinbiss, Sarkissian, Costs and 
Aboulnaga explicitly show the limitations, (Sarkissian column 2, lines 30-32; 
column 2, lines 50-67; column 3, lines 1-15; column 4, line 54 to column 5, line 
24; and column 19, line 55 to column 20, line 2). 

In reference to claim 25, Porras, Steinbiss, Sarkissian, Costs and 
Aboulnaga explicitly show the limitations, (Costa column 2, lines 21-31 ; column 
8, lines 1-41; column 8, lines 53 to column 9, line 5). 

Claims 8-10, 30, and 43-44 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over Porras, Steinbiss, Sarkissian, and Costa as 
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applied to claims above, and further in view of Fishman et al. (US Patent 
Application Publication 2001/0037321), hereinafter referred to as Fishman. 

In reference to claims 8 and 43, the references Porras, Steinbiss, 
Sarkissian, and Costa fail to disclose updating only a portion of the statistical 
model associated with the most recent record event. Nonetheless, this would 
have been an obvious modification to the aforementioned method to one of 
ordinary skill in the art at the time of the invention, as further evidenced by 
Fishman. 

In another analogous art, Fishman discloses a method for generating 
statistical models, in which the aforementioned model is updated by processing 
only the newly available records, (paragraph [0008], lines 1-18; paragraph 
[0010], lines 1-5; and abstract). One of ordinary skill in the art would have been 
so motivated to implement this modification into the aforementioned method in 
order to quickly update the model, thereby improving processing speed (Fishman 
paragraph [0037], lines 1-3). 

In reference to claims 9 and 44, Porras, Steinbiss, Sarkissian, Costs and 
Fishman explicitly show the limitations, (Porras column 2, lines 11-19 and column 
5, lines 30-35; column 6, lines 38-52 and Costa column 2, lines 21-31 ; column 8, 
lines 1-41; column 8, lines 53 to column 9, line 5). 
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In reference to claims 10 and 30, Porras, Steinbiss, Sarkissian, Costs and 
Fishman explicitly show the limitations, (Fishman paragraph [0008], lines 1-18; 
paragraph [0010], lines 1-5; and abstract). 

Claims 27-28 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Porras, Sarkissian, Kawasaki and Fishman as applied to claims 
above, and further in view of Aboulnaga et al. (US Patent 6,460,045), 
hereinafter referred to as Aboulnaga. 

In reference to claim 27, although Porras, Steinbiss, Sarkissian, 
Kawasaki, and Fishman show substantial features to the claimed invention, the 
references fail to show explicitly the method generating a histogram statistical 
model representative of the network data. Nonetheless, histogram statistical 
models were well known in the art at the time of the invention, as further 
evidenced by Aboulnaga. Therefore, this limitation would have been an obvious 
modification to the aforementioned method, as disclosed by the references, for 
one of ordinary skill in the art. 

In an analogous art, Aboulnaga discloses a method of building histogram 
statistical models, (column 5, line 37 to column 6, line 3). This modification would 
have been obvious to one of ordinary skill in the art, so as to increase the 
accuracy of the statistical model estimations and thereby increasing process 
effectiveness, (Aboulnaga column 1, lines 54-55). 

In reference to claim 28, Porras, Steinbiss, Sarkissian, Costa, Fishman, 
and Aboulnaga explicitly show the limitations, (Aboulnaga column 5, line 37 to 
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column 6, line 3 and Fishman paragraph [0008], lines 1-18; paragraph [0010], 
lines 1-5; and abstract). 

Claim 36 is rejected under 35 U.S.C. 103(a) as being unpatentable 
over Porras, Sarkissian, Fishman, and Costa as applied to claims above, 
and further in view of Aboulnaga et al. (US Patent 6,460,045), hereinafter 
referred to as Aboulnaga. 

In reference to claim 36, although Porras, Sarkissian, Fishman, and 
Costa show substantial features to the claimed invention, the references fail to 
show explicitly the method generating a histogram statistical model 
representative of the network data. Nonetheless, histogram statistical models 
were well known in the art at the time of the invention, as further evidenced by 
Aboulnaga. Therefore, this limitation would have been an obvious modification to 
the aforementioned method, as disclosed by the references, for one of ordinary 
skill in the art. 

In an analogous art, Aboulnaga discloses a method of building histogram 
statistical models, (column 5, line 37 to column 6, line 3). This modification would 
have been obvious to one of ordinary skill in the art, so as to increase the 
accuracy of the statistical model estimations and thereby increasing process 
effectiveness, (Aboulnaga column 1, lines 54-55). 
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Conclusion 

Any inquiry concerning this communication or earlier communications from 
the examiner should be directed to LaShanya R Nash whose telephone number 
is (571)272-3957. The examiner can normally be reached on 9am-5pm. 

If attempts to reach the examiner by telephone are unsuccessful, the 
examiner's supervisor, Glenton Burgess can be reached on (571)272-3949. The 
fax phone number for the organization where this application or proceeding is 
assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from 
the Patent Application Information Retrieval (PAIR) system. Status information 
for published applications may be obtained from either Private PAIR or Public 
PAIR. Status information for unpublished applications is available through 
Private PAIR only. For more information about the PAIR system, see http://pair- 
direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll- 
free). 



LaShanya Nash 
AU 2153 

November 29, 2004 
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